KUBERNETES V1.37: POD CERTIFICATES AND CLUSTER TRUST BUNDLES

Summary from the TLDR DevOps newsletter

Kubernetes 1.37 brings Pod Certificates and Cluster Trust Bundles to general availability, adding X.509 certificate issuance for TLS and mTLS directly into core Kubernetes. The feature is designed as an alternative to service account JWTs, which are bearer tokens, meaning anyone who receives a copy of the token can use it to impersonate the workload. Pod Certificates use proof-of-possession credentials, so a workload proves it holds a private key without ever sending that key to a peer. The Kubernetes project has also released Tinycert, a third-party signer for experimenting with Pod Certificates, since no built-in signers ship with core Kubernetes yet.